1. Field of the Invention
The present invention relates to a system for control of the state of an object of control to meet the target in a computer system applied to a movable body, and more particularly to a control system that sets a higher control target or improves reliability and hence stability of the system taking account of gain and risk that would occur along with execution of the control.
2. Description of the Background Art
In the field of movable bodies that move autonomously, including vehicles such as automobiles, there has been a continuous demand for improvement in control performance of vehicle control systems, along with tightened environmental regulations, increased demands for better fuel efficiency and the like. With the vehicle control systems highly computerized, a great number of electronic control units (ECUs) incorporated in a vehicle execute software to control the vehicle. Recently, in addition to the fundamental functions of the vehicle to “run, turn and stop”, additional functions with provision of control systems of transmission and engine connected to a navigation device, and driving assist systems for auto cruise, lane keep and others, have been realized by software executed by the ECUs dedicated to the respective functions.
In the control system as described above, reliability is ensured only when there is no error in data input to the ECUs and in operations by the software within the ECUs. Japanese Patent Laying-Open No. 11-039586 (Document 1) discloses an automatic driving control device concerning this issue. The automatic driving control device communicates data between a plurality of electronic control devices, and controls the automatic driving of the vehicle by means of the plurality of electronic control devices. When data received from the sender-side electronic control device is continuous data indicating the running state of the vehicle in time series, it is determined that abnormality has occurred when a change in the received continuous data is out of a predetermined feasible range.
With this automatic driving control device, it is possible to check reliability of the data upon automatic driving of the vehicle, to control the vehicle as appropriate.
In Document 1, reliability of the data is determined in the following manner. Firstly, in the case where a difference between two continuous pieces of data of current vehicle speed is out of a physically possible range (e.g., ±3 km/h), it is temporarily determined that data is abnormal. When it is determined as abnormal continuously for longer than 0.5 seconds since the first temporary abnormality judgment, it is determined that abnormality has surely occurred related to continuity of data. As such, particular values for range and time are employed as threshold values, which are compared with actual values to determine presence/absence of abnormality.
In the conventional control system according to the above-described technique, it is determined as abnormal when deviation from a target value for control exceeds a predetermined threshold value. This means that a measure against abnormality can be conducted only after the deviation actually exceeds the threshold value. For example, when the deviation exceeds the threshold value, it is checked whether the input sensor of the control system is abnormal, or it is checked whether there is an error in an operational expression from the intermediate result of operation, and modification is made so as to realize a target control value (in a simplified manner, for example). These measures, however, cannot be conducted until the deviation exceeds the threshold value, which means that it is difficult to predict the abnormality to address the same.
In this regard, if not restricted to the control system, a variety of management methods such as risk management and others have been proposed. For example, a risk hedge system estimates profit (gain) to be obtained in the future, taking business risk into consideration. One of such systems handles occurrence of risk with a probability theory, and obtains an optimal solution for business expansion to increase the profit (gain) while avoiding risk (risk hedge).
In the control system involving vehicle control, it is considered that application of the above-described processing is difficult, due to the following reasons:
1) that gain and risk are not subject to management in the same dimension on the control system; and
2) that since risk is not taken into consideration, stopping the control system would be the only conceivable measure to address the occurrence of risk.
Accordingly, it is difficult to realize risk management in the control system that can obtain largest possible gain (improved fuel efficiency, optimized exhaust gas purification) while preventing risk from occurring.